Trailrunner7 shares a report: All of the current versions of Docker have a vulnerability that can allow an attacker to get read-write access to any path on the host server. The weakness is the result of a race condition in the Docker software and while there's a fix in the works, it has not yet been integrated. The bug is the result of the way that the Docker software handles some symbolic links, which are files that have paths to other directories or files. Researcher Aleksa Sarai discovered that in some situations, an attacker can insert his own symlink into a path during a short time window between the time that the path has been resolved and the time it is operated on. This is a variant of the time of check to time of use (TOCTOU) problem, specifically with the "docker cp" command, which copies files to and from containers.

"The basic premise of this attack is that FollowSymlinkInScope suffers from a fairly fundamental TOCTOU attack. The purpose of FollowSymlinkInScope is to take a given path and safely resolve it as though the process was inside the container. After the full path has been resolved, the resolved path is passed around a bit and then operated on a bit later (in the case of 'docker cp' it is opened when creating the archive that is streamed to the client)," Sarai said in his advisory on the problem. "If an attacker can add a symlink component to the path after the resolution but beforeit is operated on, then you could end up resolving the symlink path component on the host as root. In the case of 'docker cp' this gives you read and write access to any path on the host."

Huawei is stepping up its fight against American bans. From a report: The tech giant has motioned for a summary judgment in its lawsuit to invalidate Section 889 of the 2019 National Defense Authorization Act, arguing that it violates the "Bill of Attainder, Due Process and Vesting" clauses of the US Constitution. The law explicitly bans Huawei by name despite "no evidence" of a security risk, Huawei's Song Liuping said, and bans third-party contractors who buy from Huawei even when there's no link to the US government. The company also preemptively tried to dismiss claims that there are facts up for dispute. This is a simple "matter of law," according to lead counsel Glen Nager.

"The Net interprets censorship as damage and routes around it," said Internet pioneer John Gilmore in a 1993 Time magazine article about a then-ungoverned place called "cyberspace." How times have changed. From a report: In April, Sri Lankan authorities blocked its citizens' access to social media sites like Facebook and YouTube following a major terrorist attack. Such censorship, once considered all but inconceivable, is now commonplace in a growing number of countries. Russia, for instance, approved an "Internet sovereignty" law in May that gives the government broad power to dictate what its citizens can see online. And China is not just perfecting its "Great Firewall," which blocks such things as searches for "Tiananmen Square" and the New York Times, but is seeking to export its top-down version of the web to countries throughout Southeast Asia.

This phenomenon, colloquially called "splinternet," whereby governments seek to fence off the World Wide Web into a series of national Internets, isn't new. The term, also known as cyberbalkanization, has been around since the 1990s. But lately the rupturing has accelerated, as companies censor their sites to comply with national rules and governments blot out some sites entirely. "It feels like a chunk of the Internet is gone or different. People feel the Internet is not as we knew it," says Venkat Balasubramani, who runs a cyber law firm in Seattle. Technology is one reason for the change. According to Danny O'Brien of the digital civil rights group Electronic Frontier Foundation, the sort of censorship tools deployed by China were enormously expensive and labor-Âintensive. But now, as the tools become cheaper and more efficient, other countries are willing to try them too. Meanwhile, there is a new political will among governments to try to control websites -- especially following events like the Arab Spring, during which Facebook and Twitter helped fuel political uprisings.

Flipboard, a news aggregator service and mobile news app, notified users this week of a security incident during which hackers had access to internal systems for more than nine months. From a report: In a series of emails seen by ZDNet that the company sent out to impacted users, Flipboard said hackers gained access to databases the company was using to store customer information. Flipboard said these databases stored information such as Flipboard usernames, hashed and uniquely salted passwords, and in some cases, emails or digital tokens that linked Flipboard profiles to accounts on third-party services. The good news appears to be that the vast majority of passwords were hashed with a strong password-hashing algorithm named bcrypt, currently considered very hard to crack.

An anonymous reader shares a report: Every week millions of these requests are sent to hosting platforms, as well as third-party services, such as search engines. Quite a few of the major players, including Twitter, Google, and Bing, publish these requests online. However, due to the massive volume, it's hard for casual observers to spot any trends in the data. Researchers from Queen Mary University of London and Boston University aim to add some context with an elaborate study covering a broad database of takedown requests. Their results are now bundled in a paper titled: "Who Watches the Watchmen: Exploring Complaints on the Web."

The research covers all takedown requests that were made available through the Lumen Database in 2017. The majority of these were sent to Google, with Bing, Twitter, and Periscope as runners-up. In total, more than one billion reported URLs were analyzed. Most takedown requests or 'web complaints' were copyright-related, 98.6% to be precise. This means that other notices, such as defamation reports, court orders, and Government requests, make up a tiny minority. The researchers report that the complaints were submitted by 38,523 unique senders, covering 1.05 billion URLs. While that's a massive number, most reported links are filed by a very small group of senders.

As it faces both an antitrust lawsuit with huge implications and a formal EU investigation over its App Store tactics, Apple today defended itself against Spotify and other critics of the company's massively successful software storefront. From a report: "Today, the App Store is more vibrant and innovative than ever, offering equal opportunities to developers to deliver their apps and services across iPhone, iPad, Mac, Apple TV, and Apple Watch," reads a new page at Apple's website titled "App Store -- Principles and Practices." "We're proud of the store we've built and the way we've built it." Apple says it has paid out $120 billion to App Store developers worldwide since the platform launched, and the company again touts the quick approval process and efficient work of its app review team, which now "represents 81 languages across three time zones." Sixty percent of the approximately 100,000 apps and app updates reviewed each week are approved, with rejections mostly stemming from "minor bugs, followed by privacy concerns." Apple notes that anyone who feels that they were unjustly rejected can have their situation looked at by the App Store Review Board.

But the most interesting parts of this new site relate to competition. In one section, Apple goes over the core, built-in apps on iOS and lists the many popular third-party options that are available from the App Store in each category as alternatives. The company fails to mention that none of these apps can be chosen as the default messaging app, maps service, email client, web browser, or music player. That limitation isn't always a deal-breaker -- just ask WhatsApp, which is more popular than iMessage in many countries -- but it still gives Apple's services an advantage. [...] The message here seems to be that if companies don't like Apple's policies, they've got other options. Go find your riches on Android or make a Roku app.

Drones have become an increasingly popular tool for industry and government. But the Department of Homeland Security is warning that drones manufactured by Chinese companies could pose security risks, including that the data they gather could be stolen. From a report: The department sent out an alert on the subject on May 20, and a video on its website notes that drones in general pose multiple threats, including "their potential use for terrorism, mass casualty incidents, interference with air traffic, as well as corporate espionage and invasions of privacy." "We're not being paranoid," the video's narrator adds. Most drones bought in the U.S. are manufactured in China, with most of those drones made by one company, DJI Technology. Lanier Watkins, a cyber-research scientist at Johns Hopkins University's Information Security Institute, said his team discovered vulnerabilities in DJI's drones. "We could pull information down and upload information on a flying drone," Watkins said. "You could also hijack the drone." The vulnerabilities meant that "someone who was interested in, you know, where a certain pipeline network was or maybe the vulnerabilities in a power utilities' wiring might be able to access that information," he noted.

Microsoft still hasn't officially confirmed the existence of its rumored Windows Lite operating system, but the software giant is dropping some pretty big hints about the future of Windows today. From a report: Nick Parker, Microsoft's corporate vice president of consumer and device sales, appeared on stage at Computex today to detail the company's vision for a modern operating system. While Parker didn't unveil Windows Lite, a rumored lightweight version of Windows for dual-screen and Chromebook-like devices, he did reveal how Microsoft is preparing for new device types. These new devices will require what Microsoft calls a "modern OS," that includes a bunch of "enablers" like seamless updates. We've seen various promises about Windows Updates being improved over the years, but Microsoft is now promising that "modern OS updates are invisibly done in the background; the update experience is deterministic, reliable, and instant with no interruptions!" No interruptions and done in the background sounds very different from the Windows Update experience available on Windows 10 today, and it sounds far more Chrome OS-like. This "modern OS" is also secure by default according to Microsoft, meaning the state is separated from the OS and compute is "separated from applications," which sounds a lot more cloud-powered than what we're used to today. Microsoft also wants this modern OS to work with 5G connectivity, and to include a variety of inputs like pen, voice, touch, even gaze.

An anonymous reader quotes a report from Engadget: Sony is quietly launching a chip that could change how e-bikes, cars, street lamps and all kinds of other connected devices can relay information. The module, when installed on any IoT object, will allow it send data to Sony's proprietary low-power wide area (LPWA) ELTRES network launching this fall. It can transmit up to about 60 miles and work in noisy urban environments on objects moving at high speeds, opening up a lot of new applications in security, monitoring, tracking and more. Sony's ELTRES LPWA network harnesses low-power wireless technology to transfer low-bit data across a wide area, with lower power consumption, making it feasible to connect a wide range of devices.

The CXM1501GR chip transmits signals in the 920MHz band to Sony's ELTRES network, and is also equipped with GPS/GNSS sensors to obtain time and position data. Sony said it'll work in a "broad range of IoT devices, aiming to develop various services making the most of stable wireless communications over long distances and while moving at high speeds, thereby creating a new market." In a use case document, Sony said the tech could be used to "help friends find each other at a ski hill," track wildlife, geolocate ships, follow yacht races, monitor bike rentals, while tracking numerous things like drones, rental cars and trains. The chip is limited to Japan for now, but Sony has launched an application program for interested companies and the company does have plans to build out the network.

SpaceX's Starlink satellites -- recently launched from Cape Canaveral last week -- may obstruct the view of the universe, posing serious problems for astronomers. It's not much of a problem now as there are only 60 satellites at present, but eventually that number will reach 12,000, and a megaconstellation will encircle the Earth. CNET reports: The first batch of satellites were launched from Cape Canaveral, Florida, and deployed to orbit by a Falcon 9 rocket on May 23. Each contains a single solar array, which both captures and bounces sunlight off the satellites and, as a result, can sometimes be seen from Earth. On May 25, as the drifting luminescent army of satellites zoomed overhead, Dutch satellite tracker Marco Langbroek captured their marching, posting a stunning video to Vimeo. In time, the satellites will drift apart and head to specific orbits so that satellite internet coverage can be beamed to every corner of the globe.

Will we find ourselves in a position where it's impossible to investigate the cosmos from the ground? The quick answer: not forever, no. SpaceX designed the Starlink satellites to fall back to the Earth after about five years of service, burning up in the atmosphere on their way back in. But the long answer is: potentially. Astronomers already wrangle with the problems posed by space robots and satellites circling the Earth whenever they turn their ground-based telescopes toward the stars. Bright, reflective surfaces pose a problem because they obstruct our view of the universe. More satellites equals cloudier vision, and Starlink plans to launch more satellites than ever. Elon Musk jumped to the defense of his satellite system, tweeting how "potentially helping billions of economically disadvantaged people is the greater good," while making it clear that SpaceX plans to limit Starlink's effects on astronomy. "We care a great deal about science," Musk tweeted. He said he's sent a note to the Starlink team to reduce the amount of light the satellites reflect.

An anonymous reader quotes a report from Thurrott: Microsoft started testing a new Microsoft Edge browser based on Chromium a little while ago. The company has been releasing new canary and dev builds for the browser over the last few weeks, and the preview is actually really great. But if you watch YouTube quite a lot, you will face a new problem on the new Edge. It turns out, Google has randomly disabled the modern YouTube experience for users of the new Microsoft Edge. Users are now redirected to the old YouTube experience, which lacks the modern design as well as the dark theme for YouTube, as first spotted by Gustave Monce. And when you try to manually access the new YouTube from youtube.com/new, YouTube simply asks users to download Google Chrome, stating that the Edge browser isn't supported. Ironically, the same page states "We support the latest versions of Chrome, Firefox, Opera, Safari, and Edge." The change affects the latest versions of Microsoft Edge Canary and Dev channels. It is worth noting that the classic Microsoft Edge based on EdgeHTML continues to work fine with the modern YouTube experience.

Samsung on Tuesday announced the launch of two new chips that it says will support secure, fast-charging USB-C power delivery controllers. "One of them, the SE8A, is what the company calls the industry's first solution that combines a power delivery controller and Secure Element in a single chip, offering new protections like security key storage," reports BGR. "Another result of the development of these new power delivery controllers is that Samsung's power chargers will now be able to support up to a 100W capacity: A 10x improvement over the 10W of a general smartphone charger." From the report: Samsung said the MM101 supports a symmetric encryption algorithm called the Advanced Encryption Standard that enables product authentication and includes moisture sensing capabilities to ensure safer charging conditions. The SE8A supports USB Type-C Authentication, the certificate-based authentication program for USB-C chargers and devices. "With enhanced security," Samsung explained in the announcement, "the SE8A opens possibilities for new kinds of content and services that may be exclusive to a certain brand, location or event."

Today's announcement is also significant because Samsung says the new power delivery controllers meet the most recent USB specs for fast-charging which addresses things like compatibility and efficiency challenges across mobile devices and other electronics. Those challenges can have effects like causing a device to, for example, charge slower than usual in addition to compromising the battery's life cycle.

According to a peer-reviewed paper revealed this week, Google is continuing its experiments into the controversial science of cold fusion -- the theory that nuclear fusion, the process that powers the Sun, can produce energy in a table-top experiment at room temperature. While Google's recent project found no evidence that cold fusion is possible, it did make some advances in measurement and materials-science techniques that the researchers say could benefit energy research. "The team also hopes that its work will inspire others to revisit cold-fusion experiments, even if the phenomenon still fails to materialize," reports Nature. From the report: The Google team explored three experimental set-ups that have been proposed to generate cold fusion -- two involving palladium and hydrogen, and one involving metallic powders and hydrogen. None foundï evidence of fusion. The results have been published across 12 papers over the past 2 years: 9 in peer-reviewed journals and 3ï on the arXiv preprint server.

In March 1989, two U.S.-based chemists Stanley Pons and Martin Fleischmann announced that they had seen excess heat and fusion-reaction products -- signs of nuclear fusion -- when they ran a current across two palladium plates in water laden with deuterium, a heavy isotope of hydrogen. Others quickly pointed out errors in their experimental procedure. Since then, two U.S. Department of Energy reviews have found no evidence of the phenomenon . But cold fusion -- now commonly referred to as low-energy nuclear reactions -- has retained a persistent following that continues to claim evidence of success. Google's $10-million project aimed to test the cold-fusion claims rigorously in a field that lacked credible scientific data, says Matthew Trevithick, a research program manager at Google. Another goal was also to push methods in challenging experimental conditions. But, he adds: "The fact that the pay-out could be huge is definitely a component of our interest.

Three iTunes customers have filed a lawsuit against Apple accusing the company of sending personal user data to third parties to boost its revenues. "It is alleged that Apple is selling, renting or disclosing full names, addresses, genres of music and specific titles of songs purchased on the iTunes Store app on iPhones without consent or notification," reports CNET. From the report: According to documents filed with the United States District Court for the Northern District of California on Friday, Apple does this "to supplement its revenues and enhance the formidability of its brand in the eyes of mobile application developers," the lawsuit alleges. "None of the information pertaining to the music you purchase on your iPhone stays on your iPhone," the lawsuit further alleges. "While Apple profits handsomely from its unauthorized sale, rental, transmission and/or disclosure of its customers' Personal Listening Information, it does so at the expense of its customers' privacy and statutory rights."

First reported by Bloomberg, the plaintiffs -- Leigh Wheaton from Rhode Island, and Jill Paul and Trevor Paul from Michigan -- allege third parties then use this data to append several more categories, including age, gender, income, educational background and marital status. This "enhanced" data is then allegedly sold on to other third parties, the lawsuit says. The plaintiffs are representing other iTunes customers in their respective states, seeking $250 for Rhode Island class-action members under the Video, Audio, And Publication Rentals Privacy Act and $5,000 for Michigan class-action members under the Preservation of Personal Privacy Act.

While the United States is banning the use of Huawei equipment from its fifth-generation infrastructure, the Chinese telecommunications company is working to expand its share in the undersea cable market, which is dominated by the U.S., Europe and Japan. Nikkei Asian Review reports: About a decade ago, Huawei entered the business by setting up a joint venture with British company Global Marine Systems. It expanded its presence by laying short links in regions like Southeast Asia and the Russian Far East. But last September, Huawei surprised industry executives in Japan, the U.S. and Europe by completing a 6,000 km trans-Atlantic cable linking Brazil with Cameroon. This showed Huawei has acquired advanced capabilities, even though it is still far behind the established players in terms of experience and cable volume.

During the 2015-2020 period, Huawei is expected to complete 20 new cables -- mostly short ones of less than 1,000 km. Even when these are finished, Huawei's market share will be less than 10%. Over the long term, however, the company could emerge as a player to be reckoned with. Huawei is estimated to be involved in around 30 undersea cable projects at the moment. It also reportedly has a hand in about 60 projects to enhance cable landing stations to boost transmission capacity. The reality is, even if the U.S. succeeds in shutting out Huawei from 5G networks in major countries, the Chinese company could still thwart American efforts to maintain leadership in handling global data traffic. The report goes on to say that the U.S., Japan and Australia are working to address this potential threat. "Steps they are considering include banning Huawei from laying cables connected to one of the three countries, and urging other governments to prevent the company from getting involved in the construction of any major cables Informed sources."

An anonymous reader quotes a report from Ars Technica: YouTube Gaming is more or less shutting down this week. Google launched the standalone YouTube gaming vertical almost four years ago as a response to Amazon's purchase of Twitch, and on May 30, Google will shut down the standalone YouTube Gaming app and the standalone gaming.youtube.com website. The plan to shut down the gaming portal was announced in September, with a report from The Verge saying the site was dying because it simply wasn't popular. YouTube serves more than 50 billion hours of gaming content a year, but people just aren't viewing those hours through the gaming-specific site and apps. "A support page does detail some of the changes users will have to deal with, like the merging of YouTube Gaming and normal YouTube subscriptions," the report adds. "Users will also lose their list of followed games, which isn't supported on YouTube."

"Google is directing former YouTube Gaming users to a gaming sub-page on YouTube.com, which has some of the YouTube Gaming features intact, like the top live games list. On the Web, the gaming section is at YouTube.com/gaming, and you can find it in the regular YouTube app by tapping on 'trending' and then 'gaming.' Just like the standalone site, though, a normal person would be hard-pressed to discover these special interfaces."

Two months ago, Amazon halted orders from thousands of suppliers with no explanation. Panic ensued -- until the orders quietly resumed weeks later, with Amazon suggesting the pause was part of a campaign to weed out counterfeit products. Suppliers breathed a sigh of relief. Now a larger, more permanent purge is coming that will upend the relationship between the world's largest online retailer and many of its long-time vendors, Bloomberg reported Tuesday. From the report: In the next few months, bulk orders will dry up for thousands of mostly smaller suppliers, according to three people familiar with the plan. Amazon's aim is to cut costs and focus wholesale purchasing on major brands like Procter & Gamble, Sony and Lego, the people said. That will ensure the company has adequate supplies of must-have merchandise and help it compete with the likes of Walmart, Target and Best Buy. The mom-and-pops that have long relied on Amazon for a steady stream of orders will have to learn a new way of doing business on the web store. Rather than selling in bulk directly to Amazon, they'll need to win sales one shopper at a time. It's one of the biggest shifts in Amazon's e-commerce strategy since it opened the site to independent sellers almost 20 years ago.

The presidents of Peru, Colombia, Ecuador and Bolivia have criticized the recent ICANN decision to grant global retailer Amazon the rights to the .amazon top-level domain. From a report: The four leaders -- Peru's Martin Vizcarra, Colombia's Ivan Duque, Ecuador's Lenin Moreno and Bolivia's Evo Morales -- vowed to join forces in protecting their countries form what they call inadequate governance of the internet. The four leaders issued a joint statement on Sunday stating that the decision sets "a grave precedent by prioritizing private commercial interests above the considerations of state public policies, the rights of indigenous people and the preservation of the Amazon."

This week, AI experts, politicians, and CEOs will gather to ask an important question: Can the United States, China, or anyone else agree on how artificial intelligence should be used and controlled? From a report: The World Economic Forum, the international organization that brings together the world's rich and powerful to discuss global issues at Davos each year, will host the event in San Francisco. The WEF will also announce the creation of an "AI Council" designed to find common ground on policy between nations that increasingly seem at odds over the power and the potential of AI and other emerging technologies.

The issue is of paramount importance given the current geopolitical winds. AI is widely viewed as critical to national competitiveness and geopolitical advantage. The effort to find common ground is also important considering the way technology is driving a wedge between countries, especially the United States and its big economic rival, China. "Many see AI through the lens of economic and geopolitical competition," says Michael Sellitto, deputy director of the Stanford Institute for Human-Centered AI. "[They] tend to create barriers that preserve their perceived strategic advantages, in access to data or research, for example."

Asus always likes to use its hometown trade show of Computex, which also happens to be the world's biggest computer hardware event, to show off a wide and occasionally wild lineup of new products. And it's really outdone itself this time -- the headline announcement is one of the most decadent laptops ever created. From a report: The ZenBook Pro Duo has not one, but two 4K screens. (At least if you're counting horizontal pixels.) There's a 15-inch 16:9 OLED panel where you'd normally find the display on a laptop, then a 32:9 IPS "ScreenPad Plus" screen directly above the keyboard that's the same width and half the height. It's as if Asus looked at the MacBook Pro Touch Bar and thought "what if that, but with 32 times as many pixels?"

Unlike the Touch Bar, though, the ScreenPad Plus doesn't take anything away from the ZenBook Pro Duo, except presumably battery life. Asus still included a full-sized keyboard with a function row, including an escape key, and the trackpad is located directly to the right. The design is very reminiscent of Asus' Zephryus slimline gaming laptops -- you even still get the light-up etching that lets you use the trackpad as a numpad. [...] Asus has built some software for the ScreenPad Plus that makes it more of a secondary control panel, but you can also use it as a full-on monitor, or even two if you want to split it into two smaller 16:9 1080p windows. [...] No word on pricing yet.